Protect 
our 
personal 

data! 


Our data, 
our rights! 


MENU. Tom 


A MESSAGE FOR TEACHERS FROM THE 
DATA PROTECTION COMMISSION (DPC) 


Thank you very much for taking part in this important public consultation 
on data protection and children's issues. The DPC has created a pack 

of consultation materials which aim to help you to explore with your 
students the concept of personal data and data protection rights in a social 
media context. We hope that in using these materials, you can enable 
your students to contribute to our public consultation by providing their 
opinions on key issues. These materials have been developed for use in 
the classroom with children and young people aged 8 and above, with the 
support of the Ombudsman for Children's Office (OCO), and have been 
tested by the DPC with different age groups in a series of pilot workshops 
that were facilitated by the OCO in October 2018. 


HOW TEACHERS CAN USE THESE MATERIALS 


This document contains (1) a Quick-Start Guide to Data Protection for 
Teachers and (2) a lesson plan. The Quick-Start Guide gives teachers some 
background to the lesson plan with an initial overview of the basics in 
data protection, while the lesson plan will assist teachers to facilitate a 
discussion about core data protection issues. 


The lesson plan includes three activities, which together we estimate 
will take a total of 2-3 hours of teaching time, depending on the age of 
the class. Each activity has different sets of discussion points aimed at 
three different class groups: (1) 8-12 year olds, (2) junior cycle secondary 
students, and (3) senior cycle secondary students. However, teachers 
should feel free to tailor these discussion points as they see fit. 


» Activity 1 - What is personal data? 
The purpose of this activity is to introduce the concept of personal data 
and how people share personal data when they use social media. 


» Activity 2 - What are my data protection rights? 
The purpose of this activity is to introduce the concept of (1) data 
protection rights and (2) the types of "terms and conditions" that social 
media companies apply concerning their use of personal data. 


» Activity 3 - Have your say! 
This activity gives children and young people the opportunity to tell us 
what they think about the issues raised in the earlier activities. Students 
can contribute their views in response to six questions presented on a 
set of feedback posters. We are asking teachers to record the views of 
their students on these posters and to submit one set of posters per 
class. 
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ADDITIONAL MATERIALS 


The DPC has also provided the following materials in the email sent to 
schools to help teachers conduct the lesson and complete the consultation: 


» Alink to a short video message from the Commissioner for Data 
Protection, Helen Dixon, explaining why the DPC is running this 
consultation and what's involved. 


> A lesson plan slideshow - These slides should be used for the different 
activities described in the lesson plan. 


> A set of PDF feedback posters (to be printed off or filled in electronically 
by teachers). Teachers should use these feedback posters 
to record the opinions of their students in response to the questions 
set out on the posters. 


These materials can also be downloaded from the DPC's website 
(www.dataprotection.ie). 
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QUICK-START GUIDE TO 
DATA PROTECTION FOR TEACHERS 


WHAT IS PERSONAL DATA? 


Personal data is any information that relates to you personally or would identify 
you. In other words, it is any piece of information that helps someone to know who 
you are, such as your full name, your date of birth, your email address, your phone 
number, or your address. Personal data doesn't have to be in written form. It can 
also be information about what you look like or sound like, for example photos or 
videos that you have posted online, or your voice recordings. Personal data can also 
include information that you're not aware is being collected about you, e.g. your 
image might be captured on a CCTV system in a shopping centre or information 
might be collected from your phone when you log on to a public Wi-Fi network. 


€0909060000000000000000000000.48.0.08.000000000000000000000000000000000000000.2.8.0.0 008.0. 0000 © 


.00000000000000000000000000000 


WHAT IS 
DATA PROTECTION? 


fundamental right to the protection of their 
personal data. When you give your personal data 
to an organisation, they have a duty to comply with 
certain rules which limit what they can do with your 
personal data. Collectively, these rules, together with 
the rights that someone has to protect their personal 
data, are known as data protection. Data protection 
law applies just as much in the offline world as it does 
in the online world. 


Organisations which control how and why your 
personal data is used are known in data 
protection law as data controllers, while 

people who give their personal 
data to such organisations are 
called data subjects. 


WHAT DOES 
"PROCESSING" MEAN? 


: Data protection law sets out the rules that apply to 

: the processing of personal data by organisations. 

: Processing basically means using personal data and 

> doing anything with it, from collecting it to storing it, 

: retrieving it, consulting it, sharing it with someone else, 
: erasing it and destroying it. 
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WHAT IS THE "GDPR"? 


The General Data Protection Regulation 
(GDPR) is an EU law which came into force 
on 25 May 2018. It is essentially a new set 
of data protection rules designed to give 
people in the EU more control over their 
personal data. 


One of the many changes the GDPR has 
brought about is the new emphasis placed 
on the importance of the protection of 
children's personal data. Before the GDPR, 
there was no mention of children at all 
under the old EU data protection law. The 
GDPR says that children merit specific 
protection when it comes to the processing 
of their personal data because they may be 
less aware of the risks, consequences and 
safeguards involved as well as their data 
protection rights. 


WHAT DOES THE DATA PROTECTION 
COMMISSION DO? 


The Data Protection Commission (DPC) is responsible for ensuring that 
data protection laws are complied with. The DPC can take action against 
organisations who don't comply with these laws. 


One of the DPC's main tasks is to promote public awareness and 
understanding of the risks, rules, safeguards and rights in relation to 
processing personal data. This is one of the reasons why the DPC is launching 
this consultation. However, the DPC also has other important functions such 
as handling complaints lodged by individuals, investigating whether data 
protection laws are being complied with, and cooperating with data protection 
authorities in other EU Member States. 
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The DPC deals with data-protection-specific issues only, such as the age 

at which a child can exercise their own data protection rights, the use of 
children’s personal data for targeted advertising, and the obligation on 
organisations to provide clear privacy policies in child-friendly language, 
amongst other things. These issues are explored in this consultation. 
However, issues such as cyberbullying, fake news, and harmful content do not 
fall within the DPC's remit and, as such, do not form part of this consultation. 
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Individuals have the right to be informed 
about the collection and use of their 
personal data. Organisations must provide 
individuals with information such as why 
their personal data is being processed, 
how long their personal data is going to be 
kept for, and who their personal data will 
be shared with. The information should be 


presented in a concise and transparent way 


and written in clear and plain language. 
This is especially important when the 
individual is а child. This information is 
usually presented in an organisation's 
privacy policy. 


If an individual thinks that their personal 
data might be incomplete or inaccurate, 
they can ask the organisation who holds it 
to correct it. The organisation must do this 
without undue delay (usually 1 month) or 
provide the individual with a reason as to 
why they cannot comply with their request. 
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Individuals have a right to ask an 
organisation to confirm if they hold any 
personal data about them, and to obtain 
a copy of their personal data. This is 
often referred to as an “access request" 
and it should be easy to make an access 
request to an organisation. Organisations 
have one month to respond to this 
request and should provide individuals 
with a copy of their personal data free of 
charge. 


An individual can request that their 
personal data be erased by an 
organisation when, for example, the 
data the organisation holds on them is 
no longer needed or when their data 
has been used unlawfully. The right to 
erasure is particularly relevant where 
someone gave their consent to the 
processing of their personal data when 
they were a child but later wants to have 
their personal data removed, for example 
from an internet site or webpage. 


LESSON PLAN 


| ACTIVITY 1: 


WHAT IS | 
PERSONAL DATA? 


МИШ... Tom n 


LEARNING OBJECTIVE: 


To introduce the concept of personal data and how 
people share personal data when they use social media. 


SUARIEAR ACUMA 


Explain to the class that they are going to be talking about the concept of 
“personal data” today. Begin the discussion by asking the class firstly what they 
think “data” means, and secondly what “personal” means? Ask the class to give 
examples of what they think personal data might be. 
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STEP 2: 


Start a discussion about 


> social media usage 

e by showing Slide 2 of 

: the Lesson Plan Slides 

< (different social media 

< logos) and asking the : 

? following questions : 

*  (reassuring the younger s 
students that no-one will e 
get in trouble for saying ° 

: they use social media): : 
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Do you recognise 
these logos? 


Can you name 
all the different 
companies? 


Have you ever used 
any of these apps? 


Do you have any of 
these apps on your 
phone? 


What do you use 
them for? 


How often do you 
use them? 


Do you know how 
old you have to be 
to use these apps? 
Did you get your 
parents’ permission 
to sign up to these 
apps? 


Do you use any of 
these apps? 


Which would you 
say is the most 


popular among your : 


age group? 


What do you use 
these apps for? 


How often do you 
use them? 


Do you know how 
old you have to be 
to use different 
social media apps? 


Did you get your 
parents’ permission 
to sign up to any of 
these apps? 


Have you ever had 
to enter your date 
of birth in order 

to sign up to 

apps like these? 

Do you think 

this works in terms 
of keeping younger 
children off the 
platform? 
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Do you use any of 
these apps? 


Which would you 
say is the most 


popular among your : 


age group? 


What do you use 
these apps for? 


How often do you 
use them? 


Do you know how 
old you have to be 
to use different 

social media apps? 


Did you get your 
parents' permission 
to sign up to any of 
these apps? 


Have you ever had 
to enter your date 
of birth in order 

to sign up to 

apps like these? 

Do you think 

this works in terms 
of keeping younger 
children off the 
platform? 
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Start a discussion with the class, which you сап do using the questions 
below, about the different reasons why people use social media and 
why people enjoy it. For example it might be because they want to; 
chat with their friends every day; keep in touch with family and 
friends who live abroad; share photos and videos; play games; 

read about celebrities; see and read posts about things they 

like; etc. 


Ask the class the following questions: 


Why do you like using social media? 
What's your favourite social media app 
and why? 

What kind of things can social media 
help you do that you couldn't do if you 
didn't have it? 

What's your favourite thing to do on 
social media? 


Split the class into groups and ask them to 
discuss the following questions and write 
down their answers: 


Why do you think people like using 
social media? 

What do you think is the most 
popular social media app amongst 
your age group, and why? 

What kind of things can social 
media help you do that you 
couldn't do if you didn't have it? 
What's your favourite thing 

about social media? 


Ask one person from each group to 
read out their group's answers and, 
together as a class, identify the most 
common answers to each of the 
questions above. 


MEN. Tom 


Show the slide of Emily and her friends (Slide 3). Tell the class that Emily is 16 
years old and wants to join a social media platform so that she can chat with 
her friends and share photos and videos. Ask the class to pick one social media 
platform for Emily to join. In groups, ask the class to write down three pieces 
of personal data that Emily will have to give to the social media company if she 
wants to sign up for an account. Ask one person from each group to read out 
their group's answers and write the answers on the board. 


Ask the class to imagine a scenario where a 16-year old wants to sign up for a 
social media account. Ask the class to pick one social media platform for this 
exercise. In groups, ask the class to write down three pieces of personal data 
that users have to give to social media companies if they want to sign up for an 
account. Alternatively, simply ask the class to call out examples of personal data 
that users have to give to social media companies upon sign-up. 
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STEP 2: 


Show the class the registration process flow for a new app called SquadShare!, 

a fictitious social media app used for hanging out with friends, playing games, 
sharing photos and creating videos (Slides 4-7). Talk through with the class all 
the different pieces of information that a person signing up for SquadShare will 
have to hand over. Reiterate to the class that this kind of information is known 
as "personal data" and that personal data is any piece of information that helps 
someone to know who you are, such as your name, your date of birth, your 
email address, your phone number, where you live, photos or videos of you that 
you've posted, etc. 


'SquadShare is a fictitious app created by the DPC for educational purposes only in the context of this consultation. The 
materials created for this consultation are not intended to recreate, replicate or represent any existing app/platform/service 
and/or the specific terms and conditions, interface or otherwise of any app/platform/service. 
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LEARNING OBJECTIVE: 


To introduce the concept of (1) data protection rights and 
(2) the types of “terms and conditions” that social media 
companies apply concerning their use of personal data. 


Begin the discussion by asking the class what they think a right is. Encourage 
them to give examples of different kinds of rights (e.g. right to education, right to 
healthcare, etc.) This can be done in groups or as whole class discussion. 


Explain to the class that they also have rights when it comes to their personal 
data and that there is an organisation in Ireland called the Data Protection 
Commission (DPC) whose job it is to make sure that companies which collect 
people's personal data keep that personal 
data safe and secure and obey the laws on 
data protection. It's also the ОРС job to make _ Cache, ° 
sure that people know about their own data мады, ers note: 
protection rights. o т 
: Data Protection ation ON the ro] 
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Explain to the class that they're going to a T | e 
be looking at data protection rights in the ce... 


context of social media. Explain that when people sign up for a social 

media account, they have to agree to follow certain rules before they can use 

it. Different social media companies might have different rules about what they 
can do with a user's personal data, and these rules are usually explained in a 
document called Terms and Conditions. Because these documents are often 
very long and can be difficult to understand, lots of people don't read them. And 
because of this, people often don't understand the rules that they're agreeing to 
and what their data protection rights are. 


Show the class/hand out copies of Slide 8-9 and explain that these are the Terms 
and Conditions for SquadShare, the fictitious social media app they saw earlier 
in the lesson. Tell the class that these are the rules that users will have to follow 
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if they want to sign up for SquadShare. 


In groups, ask the class to discuss what they think about these rules, to highlight : 

any rules or statements that they think are unfair or surprising, and whether к 
they would sign up to SquadShare based on these rules. ° 
Once the discussion has ended, explain to the class that the rules they have к 
just read are actually typical of the types of rules that many real social media к 
companies ask users to agree to. Facilitate а discussion around this using the : 
following questions: А 

: {812 YEAR OLDS 
° Did you know about these kind of rules before you signed up for the к 
e social media apps that you use? к 
° Are there any rules that you don't like/agree with, and why? к: 
: Pu Me possc ci 
: Did you know about these kind of rules before you signed up for the е 
social media apps that you use? e 

Are there any rules that you don't like/agree with, and why? н 

Do you think social media companies make it clear that you have to : 

agree to rules like these before you sign up? : 


Would you have signed up for these apps if you had known 
about these kind of rules beforehand? 
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these types of terms and conditions that social 

media companies can get a lot of personal data about you 
when you use their apps. For example, they can know how many messages 
you've sent to a particular friend, when you've messaged that friend, what you 
search for in the app, the kind of videos you watch, what kind of posts you click 
on the most, the places you've been, details about photos and videos on your 
phone and they can even tell you what your likes and dislikes are. 


Explain to the class that because of data protection law, they have the right to 
find out what information any company, including social media companies, has 
about them if they want to know. This is called a “Right of access” under data 
protection law. Most of the time, you have to write to or email a company to get 
this kind of information but a lot of social media companies allow users to do 
this online. 


Facilitate a discussion about this using the following questions: 


What do you think about social media companies having all of this 
personal data about you? 
Do you think you would ever want to submit a request to get a copy of all 
of your personal data? Can you think of an example of when you might 
want to do this? 
Do you think your parents should be allowed to ask a social media 
company what personal data they have about you without checking with 
you first? In what circumstances? 


Why do you think companies collect this personal data? 
Do you think there are any downsides to sharing this personal data with 
social media companies? 
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Ask the class to think about the following Se to Ariana Grange this 
scenario: 16-year old Emily signed up for think yo, SInBer/bang 3 ever 
a SquadShare account three months ago receptive s. 855 Will be т 


and now she keeps seeing posts and 
videos about Ariana Grande*. Emily never 


told SquadShare that she liked Ariana Grande but she did go to see her when 
she played in Dublin а while back, and she definitely posted about the concert 
on SquadShare. Emily has recently learned that the reason she's seeing so 
many posts about Ariana Grande is because SquadShare has worked out that 
she likes her because of the videos she has viewed | 
online and the things she has posted about Ariana 
Grande. Emily didn't realise that SquadShare were 
showing her these posts on purpose. 


Ask the class to think about this: 


Can you think of any types of ads that 
you see all the time on your social 
media feed? 

Why do you think you're seeing them? 
Do you like seeing these ads? Are they 
helpful? Are they annoying? 
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Did you realise that you were seeing these kind of ads because social 
media companies knew you would be interested in them? 

Did you know that social media companies make money from showing 
you these ads because they are being paid by the company who wants to 
show the ad? What do you think about this? 

Do you think social media companies should let people your age decide if 
they agree to their information being used for advertising purposes? 


Tell the class that Emily has decided that she doesn't like Ariana Grande 
anymore and is tired of always seeing posts and videos about her. 


Ask the class: 
Do you think there's a way for Emily 
to stop seeing posts and ads about 
Ariana Grande? 
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For more info 
rectification 
Explain to the class that there is a way to do to Data Prot, 
this. If a company holds information about you 

that is incomplete or inaccurate, you have the 

right to have that information changed so that it’s correct. This is 

known as the “Right to rectification” under data protection law. In most cases, 
you will need to write to the company which holds your information to have 
this incorrect information changed. However, some social media companies 
allow you to change your information in the app settings themselves. Facilitatea — ; 
discussion about this topic using the following questions: 
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Did you know you can generally update your details and information 
about you in the app settings of social media apps? 
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Have you ever done this? 
When and why might you decide you want to do this? 


STEP 3 


A few months later, Emily decides she doesn't want SquadShare to keep any 
information about her anymore. 
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Do you think there's anything Emily can do about SquadShare having all 
of her information? 


Explain to the class that Emily can delete her SquadShare account, and can make 
sure that all of the information that the company has about her is also deleted. 
She can contact SquadShare and tell them that she wants them to delete her 
account as well as all of her personal data. Emily has a right to do this under 
data protection law and this right is known as the "Right to erasure". 
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FINAL QUESTIONS: 


Conclude this activity with a discussion on the following questions, which should 
help to bring together all of the learning points from the lesson. 


What age do you think you should be before you are allowed to tell a 
social media company to delete all your personal data? 


Do you think your parents should be involved when it comes to your 
data protection rights? How? 


Would you sign up for SquadShare if you knew that they were going to 
use your information to show you ads? 


Do you think it’s easy to find out what companies like SquadShare are 
going to do with your information when you first give it to them? 


Do you think companies like SquadShare make it clear to you what the 
rules are before you sign up for a social media account? 


Do you think you'll ever want companies like SquadShare to delete 
your personal data? 


A 


Considering what you've learned today, why do you think social 
media companies have age restrictions on their platforms? 
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This activity involves the class producing its own submission to the Data 
Protection Commission’s public consultation on children’s data protection rights 
by giving their opinions on the questions set out on each of the six feedback 
posters (there is one question on each poster). 


For this activity, you'll need to either print off the set of posters contained 
in your lesson plan pack, or display the posters on an overhead projector. 


Ask the class to think about the six different questions set out on these posters 
and to come up with answers together as a group. Please fill in the answers 
given by the class to the six questions. There can be more than one response/ 
viewpoint to each question, and these can contradict each other. We would 
just ask that you complete and submit only one set of posters per class. 
Remember, there are no right or wrong answers here - we simply want to hear 
the views of the children you teach! 


You can submit your class's set of posters to the DPC in a couple of different 
ways. Firstly, the posters can be printed off and filled in by hand, and you can 
either take photos of the completed posters or scan them, and then email them 
back to us at childrensconsultation@dataprotection.ie. 


Alternatively, the posters can be filled in electronically (click the “Fill £ Sign” tool 
when you open the file in Adobe Acrobat) and emailed back to us. Please ensure 
that no personal data whatsoever, for example students' names or addresses, 
is recorded on these posters. You may, however, like to include the class group 
on the posters, e.g. 4th class/6th class/2nd year, and you'll find a space to do so 
under each speech bubble. 


KNOW YOUR RIGHTS AND HAVE YOUR SAY! 


(6.55 How do you think companies could do a good job of explaining to you what 
they do with your personal data? 


An Coimisiún um | | | | 
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f Commission ^ | Do2 RD28, Ireland DO? RD28, Eireann 
www.dataprotection.ie 
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